CVE-2014-0780
InduSoft Web Studio Path Traversal
CVE-2014-0780 is a vulnerability (CVSS 7.5) in Indusoft Web Studio, published April 25, 2014. CISA lists it as known to be exploited, since April 15, 2022. EUVD reports exploitation since April 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.7%, the 99th percentile. No source names a fixed version.
- Severity
- 7.5 CVSS 2.0, CVE List
- Exploit chance
- 74.7%EPSS, 99th percentile
- Exploitation
- ExploitedCISA KEV,
- Fixed in
- No fix listedNo source names one
Description
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Indusoft Web Studio - Directory Traversal Information Disclosure (Metasploit) | 2017-09-13 |
What each source reports
CVE List
InduSoft Web Studio Path Traversal
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- Record
CVE-2014-0780- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22, CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2014-0811
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- Record
EUVD-2014-0811- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8mf8-x5px-f6px
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4...
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- Record
GHSA-8mf8-x5px-f6px- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
CISA KEVNo score
InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
- Record
CVE-2014-0780- Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- Record
CVE-2014-0780- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exploit-db.com/exploits/42699
cisa.gov/news-events/ics-advisories/icsa-14-107-02
securityfocus.com/bid/67056
download.indusoft.com/71.2.4/IWS71.2.4.zip
ics-cert.us-cert.gov/advisories/ICSA-14-107-02
nvd.nist.gov/vuln/detail/CVE-2014-0780
github.com/advisories/GHSA-8mf8-x5px-f6px